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Abstract — We consider the problem of cross-layer resource 
allocation in time-varying cellular wireless networks, and in- 
corporate information theoretic secrecy as a Quality of Service 
constraint. Specifically, each node in the network injects two types 
of traffic, private and open, at rates chosen in order to maximize 
a global utility function, subject to network stability and secrecy 
constraints. The secrecy constraint enforces an arbitrarily low 
mutual information leakage from the source to every node in 
the network, except for the sink node. We first obtain the 
achievable rate region for the problem for single and multi-user 
systems assuming that the nodes have full CSI of their neighbors. 
Then, we provide a joint flow control, scheduling and private 
encoding scheme, which does not rely on the knowledge of the 
prior distribution of the gain of any channel. We prove that 
our scheme achieves a utility, arbitrarily close to the maximum 
achievable utility. Numerical experiments are performed to verify 
the analytical results, and to show the efficacy of the dynamic 
control algorithm. 

I. Introduction 

In recent years, there have been a number of investigations 
on wireless information theoretic secrecy. These studies have 
been largely confined within the boundaries of the physical 
layer in the wireless scenario and they have significantly 
enhanced our understanding of the fundamental limits and 
principles governing the design and analysis of secure wire- 
less communication systems. For example, 0, 0, have 
unveiled the opportunistic secrecy principle which allows for 
transforming the multi-path fading variations into a secrecy 
advantage for the legitimate receiver, even when the eaves- 
dropper is enjoying a higher average signal-to-noise ratio 
(SNR). The fundamental role of feedback in enhancing the 
secrecy capacity of point-to-point wireless communication 
links was established in 0, 0, 0. More recent works have 
explored the use of multiple antennas to induce ambiguity 
at the eavesdropper under a variety of assumptions on the 
available transmitter channel state information (CSI) 0, 0, 
0, |[T0l . The multi-user aspect of the wireless environment 
was studied in 03, 03, 03, 03, 03, 03, 03, 03, 
03,G3,jm,E3,[l!3,||23,ll!3 revealing the potential 
gains that can be reaped from appropriately constructed user 
cooperation policies. Finally, the design of practical codes 
that approach the promised capacity limits was investigated 
in |23, J23- One of the most interesting outcomes of this 
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body of work is the discovery of the positive impacts on 
secure communications of some wireless phenomena, e.g., 
interference, which are traditionally viewed as impairments 
to be overcome. 

Despite the significant progress in information theoretic 
secrecy, most of the work has focused on physical layer 
techniques and on a single link. The area of wireless infor- 
mation theoretic secrecy remains in its infancy, especially as 
it relates to the design of wireless networks and its impact 
on network control and protocol development. Therefore, our 
understanding of the interplay between the secrecy require- 
ments and the critical functionalities of wireless networks, 
such as scheduling, routing, and congestion control remains 
very limited. 

Scheduling in wireless networks is a prominent and chal- 
lenging problem which attracted significant interest from the 
networking community. The challenge arises from the fact 
that the capacity of wireless channel is time varying due to 
multiple superimposed random effects such as mobility and 
multipath fading. Optimal scheduling in wireless networks 
has been extensively studied in the literature under various 
assumptions 00, ED, E3, G3, E3, E3- Starting with 
the seminal work of Tassiulas and Ephremides l28l where 
throughput optimality of backpressure algorithm is proven, 
policies that opportunistically exploit the time varying nature 
of the wireless channel to schedule users are shown to be 
at least as good as static policies l29l . In principle, these 
opportunistic policies schedule the user with the favorable 
channel condition to increase the overall performance of the 
system. However, without imposing individual performance 
guarantees for each user in the system, this type of scheduling 
results in unfair sharing of resources and may lead to starvation 
of some users, for example, those far away from the base 
station in a cellular network. Hence, in order to address 
fairness issues, scheduling problem was investigated jointly 
with the network utility maximization problem ll34l . l35l . l36l . 
and the stochastic network optimization framework ll37l was 
developed. 

To that end, in this paper we address the basic wireless 
network control problem in order to develop a cross-layer 
resource allocation solution that will incorporate information 
privacy, measured by equivocation, as a QoS metric. In partic- 
ular, we consider the single hop uplink setting, in which nodes 
collect private and open information, store them in separate 
queues and transmit them to the base station. At a given 
point in time, only one node is scheduled to transmit and it 
may choose to transmit some combination of open and private 
information. Our objective is to achieve privacy of information 
from the other legitimate nodes and we assume that there 
are no external malicious eavesdroppers in the system. The 
motivation to study this notion of secrecy is the following. In 
some scenarios (e.g., tactical, financial, medical), privacy of 
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Fig. 1. Uplink communication with private and open information. 

communicated information between the nodes is necessary, so 
that data intended to (or originated from) a node is not shared 
by any other legitimate node. 

First, we evaluate the region of achievable open and private 
data rate pairs for a single node scenario with and without joint 
encoding of open and private information. Then, we consider 
the multi-node scenario, and introduce private opportunistic 
scheduling. We find the achievable private information rate 
regions associated with private opportunistic scheduling and 
show that it achieves the maximum sum private information 
rate over all joint scheduling and encoding strategies. While 
private opportunistic scheduler is based on the availability of 
full CSI on the uplink channels, it does not rely on information 
on the instantaneous cross-channel (i.e., the channel between 
different nodes) CSI. It requires merely the long-term average 
rate of the cross-channel rates. To achieve privacy with this 
level of CSI, private opportunistic scheduler uses an encoding 
scheme that encodes private information over many packets. 
Note that, in the seminal paper 11381 . it was shown that 
opportunistic scheduling (without secrecy) maximizes the sum 
rate. Our result can be viewed as a generalization of this result 
to the case with secrecy. Next, we model the problem as that 
of network utility maximization. We provide a dynamic joint 
flow control, scheduling and private encoding scheme, which 
takes into account the instantaneous direct- and cross-channel 
state information but not a priori channel state distribution. 
In dynamic cross-layer control scheme private information is 
divided into a sequence of messages where each message is 
encoded into an individual packet. We prove that our scheme 
achieves a utility, arbitrarily close to the maximum utility 
achievable in this setting. We generalize dynamic cross-layer 
control scheme to a more general case when instantaneous 
cross-channel states are not known perfectly. Consequently, 
we define the notions of privacy outage and privacy goodput. 
Finally, we numerically characterize the performance of the 
dynamic control algorithm with respect to several network 
parameters, and show that its performance is fairly close to 
that of private opportunistic scheduler achievable with known 
channel priors. 

II. Problem Model 

We consider the cellular network illustrated in Fig. Q] The 
network consists of n nodes, each of which has both open 
and private information to be transmitted to a single base 
station over the associated uplink channel. When a node is 
transmitting, every other node overhears the transmission over 
the associated cross channel. We assume every channel to 
be iid block fading, with a block size of A^i channel uses. 
The entire session lasts for N2 blocks, which corresponds to a 
total of N =NiN2 channel uses. We denote the instantaneous 



achievable rate for the uplink channel of node j by Rj(k), 
which is the maximum mutual information between output 
symbols of node j and received symbols at the base station 
over block k. Likewise, we denote the rate of the cross channel 
between nodes j and i with Rji(k), which is the maximum 
mutual information between output symbols of node j and 
input symbols of node i over block k. Note that there is 
no actual data transmission between any pair of nodes, but 
parameter Rji(k) will be necessary, when we evaluate the 
private rates between node j and the base station. 

Even though our results are general for all channel state 
distributions, in numerical evaluations, we assume all channels 
to be Gaussian and the transmit power to be constant, identical 
to P for all blocks k, 1 < k < A^- We represent the uplink 
channel for node j and the cross channel between nodes j and 
i with a power gain (magnitude square of the channel gains) 
hj(k) and hji(k) respectively over block k. We normalize the 
power gains such that the (additive Gaussian) noise has unit 
variance. Then, as A^i — > °°, 



Rj(k)=log(l+Phj(k)) 
Rji{k) =\og{\ +Ph n {k)). 



(1) 
(2) 



Each node j has a private and an open message, Wj 1 " G 
{ 1 , . . . , 2 m T } and W° ven G {1, . . . , 2 NR T } respectively, to be 
transmitted to the base station over N channel uses, where R^" v 
and R°P e " denote the (long-term) private and open information 
rates respectively, for node j. Let the vector of symbols 
received by node i be Y, . To achieve perfect privacy, following 
constraint must be satisfied by node j: for all i ^ j, 



lim -7(Wf riv ;Y,) <e 



(3) 



for any given e > 0. We define the instantaneous private 
information rate of node j transmitted privately from node 
i over block k as: 



R^k) = [R j (k)-R Ji (k)]- 



(4) 



where [•]+ =max(0,-). It was shown in |39l that rate (HJi is 
achievable as —> °° and [ 1 1 took it a step further and showed 
that, as N\,N2 — > °°, a long-term private information rate of 
E R^ik) is achievable. 

The amount of open traffic, A"(k), and private traffic, A^(k), 
injected in the queues at node j (shown in Fig. []]) in block k 
are both selected by node j at the beginning of each block. 
Open and private information are stored in separate queues 
with sizes Q"(k) and Q P j{k) respectively. At any given block, 
a scheduler chooses which node will transmit and the amount 
of open and private information to be encoded over the block. 
We use the indicator variable ,fj(k) to represent the scheduler 
decision: 



Sj(k) 



1 , private information from node j 
0, otherwise 



(5) 



When we evaluate the region of achievable open and private 
data rate pairs for the single node scenario, in Section IIII-AI 
we assume that the transmitting node has perfect causal 
knowledge of its uplink channel and the cross-channel at 
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Fig. 2. Single user private communication scenario. 

every block k. Thus, the achievable region of private and 
open rates constitutes upper bound on the achievable rates 
for each node, which we find subsequently for the multiuser 
setting with partial CSI. For private opportunistic scheduler 
in the multiuser setting, we assume that, each node j has 
perfect causal knowledge of the uplink channel rate, Rj(k), 
and its prior distribution. However, we assume that it only 
has the long-term averages, E[Rjj(k)}, j of its cross- 
channel rates. To achieve privacy with this level of CSI, 
private opportunistic scheduler uses an encoding scheme that 
encodes private information over many packets. When we 
formulate our problem as that of network utility maximization 
problem, we only assume knowledge of instantaneous channel 
gains without requiring the knowledge of prior distribution of 
channel gains. Hence, private encoding is performed over a 
single block length unlike the case with private opportunistic 
scheduler. Additionally, we analyze a more realistic scenario 
when the instantaneous channel rates are not known perfectly, 
but estimated with some random additive error. The scheduled 
transmitter, j, will encode at a rate 

= [Rj (k)- Pj (k)} + , 

where Pj(k) is the rate margin, chosen such that the esti- 
mation error is taken into account. Note that when Pj(k) < 
max^jRji(k), then perfect privacy constraint ([3} is violated 
over block k. In such a case, we say that privacy outage has 
occurred. The probability of privacy outage over block k when 
user j is scheduled, is represented as p° at (pj(k)). Since perfect 
privacy cannot be ensured over every block, we require that 
expected probability of privacy outage of each user j is below 
a given threshold jj. 
III. Achievable Rates and Private Opportunistic 
Scheduling 

In this section, we evaluate the region of private and open 
rates achievable by a scheduler for multiuser uplink and 
downlink setting. We start with a single node transmitting, 
and thus, the scheduler only chooses whether to encode 
private information at any given point in time or not. We 
consider the possibility of both the separate and the joint 
encoding of private and open data. For multiuser transmission, 
we introduce our scheme, private opportunistic scheduling, 
evaluate achievable rates and show that it maximizes the sum 
private information rate achievable by any scheduler. Along 
with private opportunistic scheduling, we provide the asso- 
ciated physical-layer private encoding scheme that encodes 
information over many blocks. 

A. Single User Achievable Rates 

Consider the single user scenario in which the primary 
user (node 1) is transmitting information over the primary 



channel and a single secondary user (node 2) is overhearing the 
transmission over the secondary channel as shown in Fig. [2] In 
this scenario, we assume node 2 is passively listening without 
transmitting information and node 1 has perfect knowledge 
of instantaneous rates R\{k) and Rn(k) for all k as well as 
their sample distributions. Over each block k, the primary 
user chooses the rate of private and open information to be 
transmitted to the intended receiver. As discussed in l40l it is 
possible to encode open information at a rate Ri(k) ~ R p n {k) 
over each block k, jointly with the private information at rate 
R p 2 (k). For that, one can simply replace the randomization 
message of the binning strategy of the achievability scheme 
with the open message, which is allowed to be decoded by 
the secondary user. In the rest of the section, we analyze 
both the case in which open information can and cannot be 
encoded along with the private information. We find the region 
of achievable private and open information rates, (R^" v ,R° pen ), 
over the primary channel. 

1 ) Separate encoding of private and open messages: First 
we assume that each block contains either private or open 
information, but joint encoding over the same block is not 
allowed. Recall that J?i(k) is the indicator variable, which 
takes on a value 1, if information is encoded privately over 
block k and otherwise. Then, one can find R p " v , associated 
with the point R° pca = a by solving the following integer 
program: 

max ¥,\JAk)R p Jk)\ (6) 

subject to E[(l-^i(Jk))/?i(Jt)] > a, (7) 

where the expectations are over the joint distribution of the 
instantaneous rates R\(k) and R\2(k). Note that, since the 
channel rates are iid, the solution, J*{k) = J^iRx (k),Rn{k)) 
will be a stationary policy. Also, a necessary condition for the 
existence of a feasible solution is E > a. Dropping the 

block index k for simplicity, the problem leads to the following 
Lagrangian relaxation: 

min max E \jf\R p 7 ] + A (E \(l - J\)R\\ - a) 

i>o {.^Mo.i} 

= min i max / / \^iR P o -A(l 

A>o |j.# 1 }e{o,i}./o Jo L lz 1 

p(R h Rn) dRidRn-Xa}, (8) 

where p(Ri,Rn) is the joint pdf of R\ and ^12. For any given 
values of the Lagrange multiplier A and (Ri,Rn) pair, the 
optimal policy will choose ^(R\,R\i) = if the integrant 
is maximized for J*\ = 0, or it will choose J?i(Ri ,Rn) = 1 
otherwise. If both J?\ = and J^i = 1 lead to an identical 
value, the policy will choose one of them randomly. The 
solution can be summarized as follows: 

^ I r, ( 9) 

"1 .j?i=o 

where A* is the value of X for which E[(l — J^*)/?i] = a, 
since A*(E [(1 - J\)R\\ - a) <0. 

For Gaussian uplink and cross channels described in Sec- 
tion |n] the solution can be obtained by plugging ( 1 1 1214b in 
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Fig. 3. Optimal decision regions with separate encoding of private and open 
messages. 
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Fig. 4. Achievable rate regions for the single user scenario with iid Rayleigh 
block fading channels. 



{l+Phi 



r* =1 



(10) 



The associated solution Jf* is graphically illustrated on the 
(h\,h\i) space in Fig. [3] for P = 1. As the value of A 
varies between and 1, the optimal decision region for 
,f = increases from the upper half of the first quadrant 
represented by h\ 2 >h\ to the entire first quadrant, i.e., all 
h\,h\2 > 0. In Fig. |4j the achievable pair of private and open 
information rates, (R\" v ,R° pen ), is illustrated for iid Rayleigh 
fading Gaussian channels, i.e., the power gains hi and h\ 2 
have an exponential distribution. We considered two different 
scenarios in which the mean power gains, (E[/ii] ,E[/ii2]), are 
(2, 1) and (2,2.5), and P=l, The associated boundaries of the 
rate regions with separate encoding are illustrated with solid 
curves. To plot these boundaries, we varied A from to 1 and 
calculated the achievable rate pair for each point. Note that 
the flat portion on the top part of the rate regions for separate 
encoding corresponds to the case in which Constraint ^ is 
inactive. It is also interesting to note that as demonstrated in 
Fig.lU one can achieve non-zero private information rates even 
when the mean cross channel gain between node 1 and node 
2 is higher than the mean uplink channel gain of node 1 . 

2) Joint encoding of private and open messages: With the 
possibility of joint encoding of the open and private infor- 
mation over the same block, the indicator variable J?\ (k) = 1 
implies that the private and open information rates are R p 2 (k) 
and R\{k) — R p n (k) respectively over block k simultaneously. 
Otherwise, i.e., if J'x (k) = 0, open encoding is used solely 
over the block. To find achievable R\ m , associated with the 
point R° pcn = a, one needs to consider a slightly different 
optimization problem this time: 



E[^(k)R p 2 {k)] 
subject to E [(1 - ,^\(k))R\ (k) + J\ {k){R x (k) 



max 

{/iW}e{o,i} 



(11) 

-R p n {k))] >a, 
(12) 



This optimization problem can be solved in a similar way by 
employing Lagrangian relaxation as the problem considered in 
Section IIII-A1I First, we specify two regions of parameters 
for which the solution is trivial: 1) if E[R\] < a, no solution 
exists for (11 11121) . since the uplink channel capacity is not 
sufficient to meet the desired open rate, a; 2) if E [R\ — R p 2 ] > 
a, then J^* = 1 for all blocks, i.e., all open information will be 
encoded jointly with private information, since the remaining 
capacity over that is necessary to support private information 
is sufficient to serve open information at rate a. In this case, 
Constraint (fT2l is inactive and the achieved private information 



rate is R p " v 



E[R P 



12J 



In all other cases, i.e., E[/?i-/?f 2 ] < a < E[R\], it can 
be shown that the optimal solution can be achieved by the 
following probabilistic schemeQ: For any given block, 



1, w.p. p p 

0, w.p. 1-pP' 



E[i?i]-ce 



(13) 



The details 



independently of Ri and R12, where p p 

of the derivation of the described optimal scheme is given 
in J4TJ. With this solution, only a fraction p p of the blocks 
contain jointly encoded private and open information, and the 
remaining 1 — p p fraction of the blocks contain solely open 
information. Thus, for a given a, the achieved private and 
open information rates can be found as R v ™ = p p E [R p 2 ] = 
E[Ri] - a and fl° pen = p p E [Ri -R p 2 ] + (1 -p p )E[R l ] = a 
respectively. Rather surprisingly, it does not matter which 
blocks contain only open information and which ones contain 
jointly encoded private and open information, as long as 
the desired open information rate a is met. Consequently, a 
random scheme that chooses 1 — p p fraction of blocks for open 
information only and the rest for jointly encoded open and 
private information suffices to achieve the optimal solution. 

By the above analysis, one can conclude that the achievable 
rate region with joint encoding can be summarized by the 
intersection of two regions specified by: (i) (R^™ + R° pcn ) < 
E[Ri] and (ii) Rf " < E [R p 2 ] ■ Any point on the boundary 
of the region can be achieved by the simple probabilistic 
scheme described above. One can realize that this region is the 
maximum achievable rate region, since in our system, the total 
information rate (private and open) is upper bounded by the 
capacity, E [Ri], of uplink channel 1 and the achievable private 
rate is upper bounded by the secrecy capacity, E [R p 2 ] > of the 
associated wiretap channel. Thus, there exists no other scheme 
that can achieve a larger rate region than the one achieved by 
the simple probabilistic scheme. 

In Fig. 2] the achievable pairs of private and open infor- 
mation rates, (Rf™ ,R° ven ) with joint encoding are illustrated 
for the iid Rayleigh fading Gaussian channels with the same 
parameters as the separate encoding scenario. The boundaries 



1 Note that the solution of Problem il 11121 is not unique and the described 
probabilistic solution is just one of them. 
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Fig. 5. Multiuser private communication system - uplink 

of the regions are specified with dashed curves, which are 
plotted by varying the value of p p from to 1 and evaluating 

(E[Z?i -R-12] ^[ R n]) P air for each value - Similar to the 
separate encoding scenario, the fiat portion on the top part of 
the regions corresponds to the case in which Constraint ( PT21 
is inactive. 

B. Private Opportunistic Scheduling and Multiuser Achiev- 
able Rates 

In this section, we consider the multiuser setting described 
in Fig. [T] We introduce private opportunistic scheduling 
(POS) for the uplink scenario and prove that it achieves 
the maximum achievable sum private information rate over 
the set of all schedulers. POS schedules the node that has 
the largest instantaneous private information rate, with respect 
to the "best eavesdropper" node, which has the largest mean 
cross-channel rate. Each node ensures perfect privacy from 
its best eavesdropper node by using a binning strategy, which 
requires only the average cross-channel rates to encode the 
messages over many blocks. 

We consider the multiuser uplink scenario given in Fig. [5] 
We assume every node j has perfect causal knowledge of its 
uplink channel rate, Rj(k) for all blocks k and the average 
cross-channel rates, E [Rji(k)}, for all i^ j. 

1 ) Private Opportunistic Scheduling for uplink: We define 
the best eavesdropper of node j as i* ( j) = argmax,^ E [Rji(k)] 
and denote its average cross-channel rate with RJ = 
E [Rji*(j)(k)] ■ Note that i*(j) does not change from one block 
to another. In POS, only one of the nodes is scheduled for 
data transmission in any given block. In particular, in block k, 
we opportunistically schedule node 

j M (k) 4 argmax [Rj(lc)-Sf\ 



if max 



Ml,-,"} 



Rj(k)-R" 



assigns each random binary sequence to one of 2 NR J bins, 
so that each bin contains exactly 2 y i K i ' binary sequences. 
We call the sequences associated with a bin, the randomization 
sequences of that bin. Each bin of node j is one-to-one 

matched with a private message tvg{l 2 ' } randomly. 

This selection (along with the binary sequences contained in 
each bin) is revealed to the base station and all nodes before 
the communication starts. Then, whenever the message to be 
transmitted is selected by node j, the stochastic encoder of that 
node chooses one of the randomization sequences associated 
with each bin at random^, independently and uniformly over 
all randomization sequences associated with that bin. This 
particular randomization message is used for the transmission 
of the message and is not revealed to any of the nodes nor to 
the base station. 

Private opportunistic scheduler schedules node j M (k) in 
each block k and the transmitter transmits N\RjM^{k) bits 
of the binary sequence associated with the message of node 
j M (k) for all k £ {1, ... ,^2} ■ Thus, asymptotically, the rate of 
data transmitted by node j over A^ blocks is identical to: 

I ft < N2 

Urn -YNi J?J° 5 (k)R j (k) = lim — Y jJ os (k)R t (k) 



>pf(Rf-8) w.p. 1 



(14) 



> and no node is scheduled for 

private information transmission otherwise, i.e., j M (k) = 0. 
In case of multiple nodes achieving the same maximum 
privacy rate, the tie can be broken at random. Indicator 
variable ^fj° s (k) takes on a value 1, if node j is scheduled 
over block k and otherwise. We denote the probability 
that node j be scheduled with pj = F(j M (k) = jj and the 
associated uplink channel rate when node j is scheduled with 
j^M A ]g [Rj(k)\j = j M (k)] , where the expectations are over the 
conditional joint distribution of the instantaneous rates of all 
uplink channels, given j = j M {k). 

As will be shown shortly, private opportunistic scheduling 
achieves a private information rate R^ m = p^ (R^ — R'") for all 
j 6 {l,...,n}. To achieve this set of rates, we use the following 
private encoding strategy based on binning: To begin, node 

Nv M (R M — S) 

j generates 2 *v i ' random binary sequences. Then, it 



for any given 8 > from strong law of large numbers. Hence, 
all of N{p ! ^(R t f — 8)) bits, generated by each node j is 
transmitted with probability 1. 

2) Achievable uplink rates with private opportunistic 
scheduling: 

Theorem 1: With private opportunistic scheduling, a private 
information rate of R^" v = p^ (Rj — RJ) is achievable for each 
node j. 

The proof of this theorem is based on an equivocation 
analysis and it can be found in Appendix lAl Next we show 
that private opportunistic scheduling maximizes the achievable 
sum private information rate among all schedulers. 

Theorem 2: Among the elements of the set of all 
schedulers, {,f(R\, ... ,/?„)}, private opportunistic scheduler 
.y pos {R\ 1 . . . ,R n ) maximizes the sum privacy uplink rate, 
^sum,up ~T!j=\R P " V - Furthermore, the maximum achievable 
sum privacy uplink rate is 

*ix»=iw is?-*?)]- 

The proof of Theorem[2]can be found in Appendix |B1 There, 
we also show that the individual private information rates 
given in Theorem Q] are the maximum achievable individual 
rates with private opportunistic scheduling. Hence the converse 
of Theorem Q] also holds. Combining Theorems [T] and |2] one 
can realize that private opportunistic scheduling achieves the 
maximum achievable sum private information rate. Thus, one 
cannot increase the individual private information rate a single 
node achieves with POS by an amount A > 0, without reducing 
another node's private information rate by more than A. 

2 In case of joint encoding of private and open information, the random- 
ization sequence is chosen appropriately, corresponding to the desired open 
message. 
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Fig. 6. Bounds on the achievable sum rate region for the multiuser uplink 
scenario with iid Rayleigh block fading channels. 

Next, we find the boundary of the region of achievable 
sum open and sum private uplink rate pair with joint en- 
coding of private and open information. In opportunistic 
scheduling l38l . l29l without any privacy constraint, the user 
with the best uplink channel is scheduled for all blocks 
k. Hence, the associated achievable rate can be written as 



K 



,opp 
sum.up 



</ :i "•■ 



Rj{k)] . Since this constitutes an up- 



per bound for the achievable cumulative information rate 
the total private and open information rate in our system 
cannot exceed /?°um,up- Combining this with Theorem [2] we 
can characterize an outer bound for the achievable rate region 
for the sum rates as follows: (i) R^ m 



(ii) 



„pnv v „ 
n sum,up _ 



A/ 



sum.up i n sum,up _ n sum,up? 

Next we illustrate this 



region and discuss how the entire region can be achieved by 
POS along with joint encoding of private and open messages. 
The boundaries of this region is illustrated in Fig. [6] for a 5- 
node and a 10-node system. We assume all channels to be iid 
Rayleigh fading with mean uplink channel power gain E [hj] = 
2 and mean cross channel power gain E [hj,] = 1 or 2.5 in two 
separate scenarios for all Noise is additive Gaussian with 
unit variance and transmit power P = 1 . In these graphs, sum 
rates are normalized with respect to the number of nodes. One 
can observe that, the achievable sum rate per node decreases 
from 0.31 to 0.19 bits/channel use/node for E[/zy,-] = 1 and 
from 0.2 to 0.13 bits/channel use/node for E[/i /( ] = 2.5 as the 
number of nodes increases from 5 to 10. Also, the open rate 
per node drops from 0.47 to 0.27 bits/channel use/node with 
the same increase in the number of nodes. 

Note that, any point on the part of the boundary specified by 
(i) above (flat portion on the top part) is achievable by POS and 
jointly encoding the private information with the appropriate 
amount of open information used as a randomization message. 
For instance, the corner point of two boundaries (intersection 
of (i) and (ii)) is achieved when open information is used 
completely in place of randomization messages by all nodes. 
All points on the part of the boundary specified by (ii) can be 
achieved by time-sharing between the corner point, and point 
(^sum.up, 0), which corresponds to opportunistic scheduling 
(without privacy). 

IV. Dynamic Control of Private Communications 

In Section Hn] we determined the achievable private in- 
formation rate regions associated with private opportunistic 
scheduling which encodes messages over many blocks. Hence, 
the delay of decoding private information may be extremely 



long. Also, the private opportunistic scheduler was based on 
the availability of full CSI on the uplinks, and long-term 
average of cross-channel rates. In this section, we investigate a 
dynamic control algorithm which does not rely on any a priori 
knowledge of distributions of direct- or cross-channel rates, 
and the private information is encoded over a single block. 
Hence, a private message can be decoded with a maximum 
delay of only a single block duration. Note that even though 
by encoding over many blocks one may achieve higher private 
information rates, decoding delay may be a more important 
concern in many practical scenarios. 

In particular, each message Wf" and W; pen are broken into 

a sequence of messages, Wj m (k) and W° pen (k) respectively 
and each element of the sequence is encoded into an individual 
packet, encoded over block k. The delay-limited dynamic 
cross-layer control algorithm opportunistically schedules the 
nodes with the objective of maximizing the total expected 
utility gained from each packet transmission while maintaining 
the stability of private and open traffic queues. The algorithm 
takes as input the queue lengths and instantaneous direct- and 
cross-channel rates, and gives as output the scheduled node 
and its privacy encoding rate. In the sequel, we only consider 
joint encoding of private and open information as described 
in Section IIII-A2I 

Let gj(k) and g°(k) be the utilities obtained by node j from 
private and open transmissions over block k respectively. Let 
us define the instantaneous private information rate of node 
; as R p j(k) = mm^jR^k), where RUk) was defined in ©. 
Also, the instantaneous open rate, R"(k), is the amount of 
open information node j transmits over block k. The utility 
over block k depends on rates R'jik), and R"(k). In general, 
this dependence can be described as g p - (k) = Uj(R'j(k)) and 
g °(k) = U°(R°j{k)). Assume that Uf(0) = 0, 17? (0) = 0, and 
Uj(-), Uj(-) are concave non-decreasing functions. We also 
assume that the utility of a private transmission is higher than 
the utility of open transmission at the same rate. The amount 
of open traffic A°{k), and private traffic A^(k) injected in the 
queues at node j have long term arrival rates A? and AJ 
respectively. Our objective is to support a fraction of the traffic 
demand to achieve a long term private and open throughput 
that maximizes the sum of utilities of the nodes. 

A. Perfect Knowledge of Instantaneous CSI 

We first consider the case when every node j has perfect 
causal knowledge of its uplink channel rate, Rj(k), and cross- 
channel rates to all other nodes in the network Rji(k), V/ ^ i, 
for all blocks k. The dynamic control algorithm developed for 
this case will then provide a basis for the algorithm that we are 
going to develop for a more realistic case when cross-channel 
rates are not known perfectly. We aim to find the solution of 
the following optimization problem: 



E 



-*[«?(*)] 



(15) 



subject to (A?, A?) € A (16) 

The objective function in ( fT5l ) calculates the total expected 
utility of open and private communications where expectation 
is taken over the random achievable rates (random channel 
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conditions), and possibly over the randomized policy. The 
constraint ( [ToT l ensures that private and open injection rates 
are within the achievable rate region supported by the network 
denoted by A. In the aforementioned optimization problem, it 
is implicitly required that perfect secrecy condition given in 
OJ is satisfied in each block as N\ — > °°. 

The proposed cross-layer dynamic control algorithm is 
based on the stochastic network optimization framework de- 
veloped in 1371 . This framework allows the solution of a 
long-term stochastic optimization problem without requiring 
explicit characterization of the achievable rate region, A. 

We assume that there is an infinite backlog of data at the 
transport layer of each node. Our proposed dynamic flow 
control algorithm determines the amount of open and private 
traffic injected into the queues at the network layer. The 
dynamics of private and open traffic queues is given as follows: 



Q';(k)-R p j(k) 



Q" j (k+l)=[Q'>(k)-R°(k)]- 



-A°j(k), 



(17) 
(18) 



where [x] = max{0,jc}, and the service rates of private and 
open queues are given as, 



R P j(k) = J?f(k) 



Rj(k)-maxRji(k) 



and 



R°(k) = J??(k)Rj(k)+J? J p (k)(Rj(k)-R p j (k)). 

where J? p (k) and ^°{k) are indicator functions taking value 
■#j{k) — 1 when transmitting jointly encoded private and open 
traffic, or ^"(k) = 1 when transmitting only open traffic over 
block k respectively. Also note that at any block k, Y,j ^f{k) + 

y°(k) < i. 

Control Algorithm: The algorithm is a simple index policy 
and it executes the following steps in each block k: 
(1) Flow control: For some V > 0, each node j injects A P (k) 
private and A"(k) open bits, where 

(A P (k),A°j(k)) = argmax [v [u p (A p ) + U](A°) 



(Q p (k)A» + Q»(k)A<>)} 



(2) Scheduling: Schedule node j and transmit jointly encoded 
private and open traffic = 1), or only open = 1) 
traffic, where 

(j?f(k),J?°(k)) = argmax { Q p (k)R p (k) + Q°j(k)R° (*)} , 

and for each node j, encode private data over each block k at 
rate 

RP{k) = J p (k) Rj(k)-mzxRji(k) , 
L ¥J 

and transmit open data at rate 

R° j (k)=S?(k)Rj(k) + J? J p (k)(Rj(k)-R p (k)) 

Optimality of Control Algorithm: The optimality of the 
algorithm can be shown using the Lyapunov optimization 
theorem 071 . Before restating this theorem, we define the 
following parameters. Let W(k) = (W\(k), . . . ,W„(k)) be the 
queue backlog process, and let our objective be the maxi- 
mization of time average of a scalar valued function /(•) of 
another process R(£) while keeping W(k) finite. Also define 



A(W(/t)) =E[L(W(Jt+l))-L(W(Jt))|W(Jt)] as the drift of 
some appropriate Lyapunov function L(-). 

Theorem 3: (Lyapunov Optimization) 1371 For the scalar 
valued function /(•), if there exists positive constants V, £, B, 
such that for all blocks k and all unfinished work vector W(A:) 
the Lyapunov drift satisfies: 

A(W(*)) - VE [f(R(*))|W(*)] <B-Vf -e £ Wj(k), (19) 

7=1 

then the time average utility and queue backlog satisfy: 

l T M w £ E ^( R W)] ^ f * - v (20) 



N 2 ^ N 2 k=Q j=l £ 



(21) 



where /* is the maximal value of E [/(■)] and / = 
limsup^^^El/CRC*))]. 

For our purposes, we consider private and open unfin- 
ished work vectors as QP(k) = (Q p {k),Q P {k), . . . ,Q p (k)), 
and Q°(k) = (Qi(k),Q° 2 (k),...,Q° n (k)). Let L(QP,Q°) be 
quadratic Lyapunov function of private and open queue back- 
logs defined as: 



L(QP(k),Q°(k)) = (Q p (k)) 2 + (Q°(k)) 



(22) 



Also consider the one-step expected Lyapunov drift, A(k) for 
the Lyapunov function (l22l as: 

A(fe)=E[L(QP(k+l),Q°(k + l)) 

-L(QP(k),Q°(k))|QP(k),Q°(k)]. (23) 

The following lemma provides an upper bound on A(k). 
Lemma 1: 

A(k) <B-£m[Q P (k)(R p (k)-A P (k)) | Q p (k) 
j 

-£E [0rj(k)(R°j(k) -A°j(k)) I Q°j(k)] , (24) 
j 

where B > is a constant. 

The proof of Lemma [T] is given in Appendix [C] Now, we 
present our main result showing that our proposed dynamic 
control algorithm can achieve a performance arbitrarily close 
to the optimal solution while keeping the queue backlogs 
bounded. 

Theorem 4: If Rj(k) < °° for all j,k, then dynamic control 
algorithm satisfies: 



/V 2 -i 



k=0 ./'=! 



^ S — 



B 

V 



N 2 -l n 



hmsup- £ L E Qj( k ) 



2 A-=0 j=\ 



1 



N 2 -\ n 



hmsup- £ Z E [Q°M < 



B + V(g-g*) 
£i 

B + V(g-g*) 
£2 



where B,£\,£ 2 > are constants, g* is the optimal solution of 
(fT3t-(n~6b and g is the maximum possible aggregate utility. 
The proof of Theorem [4] is given in Appendix [D] 
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B. Imperfect Knowledge of Instantaneous CSI 

In the previous section, we performed our analysis assuming 
that at every block exact instantaneous cross-channel rates 
are available. However, unlike the uplink direct channel rate 
which can be determined by the base station prior to the data 
transmission (e.g., via pilot signal transmission), cross-channel 
rates are harder to be estimated. Indeed, in a non-cooperative 
network in which nodes do not exchange their CSI, the cross- 
channel rates {Rji,j ^ /} can only be inferred by node j from 
the received signals over the reverse channel as nodes j ^ i 
are transmitting to the base station. Hence, at a given block, 
nodes only have a posteriori channel distribution. Based on 
this a posteriori channel distribution, nodes may estimate CSI 
of their cross-channels. 

Let us denote the estimated rate of the cross-channel (j, i) 
with Rji(k). We also define cross-channel rate margin pj(k) 
as the cross-channel rate a node uses when it encodes private 
information. More specifically, node j encodes its private 
information at rate: 



R p j (k)=Rj(k)-p j (k), 



(25) 



i.e., Pj(k) is the rate of the randomization message node j 
uses in the random binning scheme for privacy. Note that, if 
Pj(k) < maXj^jRji(k), then node j will not meet the perfect 
secrecy constraint at block k, leading to a privacy outage. In 
the event of a privacy outage, the privately encoded message 
is considered as an open message. The probability of privacy 
outage over block k for the scheduled node j, given the 
estimates of the cross channel rates is: 



pf(Pj(k))=] 



mzxR ji (k)>p J (k) {R-ji(k),i^j} 



(26) 



Compare the aforementioned definition of privacy outage with 
the channel outage f42l experienced in fast varying wireless 
channels. In time-varying wireless channels, channel outage 
occurs when received signal and interference/noise ratio drops 
below a threshold necessary for correct decoding of the 
transmitted signal. Hence, the largest rate of reliable commu- 
nications at a given outage probability is an important measure 
of channel quality. In the following, we aim to determine 
utility maximizing achievable privacy and open transmission 
rates for given privacy outage probabilities. In particular, we 
consider the solution of the following optimization problem: 



n 

max ^ 



E 



*{k) +E[g°(k)] 



subject to (k°,kf) G A, 
and pf(pj(k)) = Yj , 



(27) 

(28) 
(29) 



where Yj is the tolerable privacy outage probability. Aforemen- 
tioned optimization problem is the same as the one given for 
perfect CSI except for the last constraint. The additional con- 
straint ( f29b requires that only a certain prescribed proportion of 
private transmissions are allowed to violate the perfect privacy 
constraint. Due to privacy outages we define private goodput 



of user j as E 



Rj(k){l-pf\ Pj (k)) 



Note that private 



privacy constraint is satisfied. All private messages for which 
(0 is violated are counted as successful open transmissions. 

Similar to the perfect CSI case, we argue that a dynamic 
policy can be used to achieve asymptotically optimal solution. 
Unlike the algorithm given in the perfect CSI case, the 
algorithm for imperfect CSI first determines the private data 
encoding rate so that the privacy outage constraint ( |29| i is 
satisfied in current block. Hence, the private encoding rate 
at a particular block is determined by the estimated channel 
rates and the privacy outage constraint. 
Control Algorithm: Similar to the perfect CSI case, our 
algorithm involves two steps in each block k: 
(1) Flow Control: For some V > 0, each node injects A p - (k) 
private and A"(k) open bits, where 



A p (k),A°j(k)) =argmax V Uf(A P j)(l - Yj) 



+Uj(A°j)(l-Yj) + Uj(A°j+A p ) Yj 
-Q p (k)A P -Q°(k)A°. 



(30) 



(2) Scheduling: Schedule node j and transmit jointly encoded 
private and open traffic = 1) or only open = 1) 
traffic, where 

(Sf (k) , J<> (*)) = argmax { Q p (k)R p (k) + Q) (k)R° (k) } . 



For each node j, encode private data over each block k at rate 

R p .(k) = J?f(k) [Rj(k) P j{k)] , Pj (k) = pf' ( Yj ), 
and transmit open data at rate 

R°j(k) = Jt°(k)Rj{k) + yf(k)(Rj(k)-R P j(k)). 
Optimality of Control Algorithm: The optimality of the 
control algorithm with imperfect CSI can be shown in a similar 
fashion as for the control algorithm with perfect CSI. We use 
the same Lyapunov function defined in ( 1221 which results 
in the same one-step Lyapunov drift function d23l l. Hence, 
Lemma Q] also holds for the case of imperfect CSI, but with 
a different constant B' due to the fact that higher maximum 
private information rates can be achieved by allowing privacy 
outages. 

Lyapunov Optimization Theorem suggests that a good con- 
trol strategy is the one that minimizes the following: 



A u (k) = A(k) — VE 



(31) 



In OTb . expectation is over all possible channel states. The 
expected utility for private and open transmissions are respec- 
tively given as: 

= E 



goodput only includes private messages for which perfect 



= (l- Yj )E[u p (A p (k))], (32) 

E [g°j(k)] = E [fl{k)\Sf(k),Sf(k), Pj (k)[ 

= 7j E [ufW(k)+A°j(k)j 

+ (l-Yj)®[U](A j(k))}. (33) 

Note that ([32])-([33]) are obtained due to Constraint ([29]l. By 
combining Lemma Q] with (|32l-(l33l we may obtain an upper 
bound for (l3Tl l. as follows: 
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A u (k) <tf-£E G?(*)[tf?(*)-A;(*)] 

j 

-Y,E[Q°(k){R«(k)-A»(k)}]-VE 



■^YjUjiA^k) +A°{k)) + (1 - Yj)Uj(A°j(k)) 



(34) 



Now, it is clear that the proposed dynamic control algorithm 
minimizes the right hand side of (134) . The steps of proving 
the optimality of the dynamic control algorithm are exactly 
the same as those given in Theorem H] and hence, we skip the 
details. 

Theorem 5: If Rj(k) < °°, for all j,k then dynamic control 
algorithm satisfies: 

1 #2—1 n r>l 

liminf- £ £ E[g p j(k) +g°j(k)] >g'*- V (35) 
limsup-L £ EE[ff(*)]< * +y ; g j 



AT 2 - 



^2 f ;tl 



1 



#2-1 n 



limsup- £ £E[(2J(*;)]< 

# 2 ^~ JV 2 i=0 ;=1 



where B',eJ,e^ > are constants, g'* is the optimal solution 
of <|27j)-(|29]l and g' is the maximum possible aggregate utility. 

V. Numerical Results 

In our numerical experiments, we considered a network 
consisting of ten nodes and a single base station. The direct 
channel between a node and the base station, and the cross- 
channels between pairs of nodes are modeled as iid Rayleigh 
fading Gaussian channels. Thus, direct-channel and cross- 
channel power gains are exponentially distributed with means 
chosen uniformly randomly in the intervals [2,8], and [0,1], 
respectively. The noise normalized power is P = 1. In our 
simulations, we consider both of the cases when perfect in- 
stantaneous CSI is available, and when instantaneous CSI can 
only be estimated with some error. Unless otherwise indicated, 
in the case of imperfect CSI, we take the tolerable privacy 
outage probability as 0.1. We assumed the use of an unbiased 
estimator for the cross-channel power gains and modeled the 
associated estimation error with a Gaussian random variable: 

hji(k)=hj i (k) + e ji (k), 

where e ~ ^V(0,a 2 ) for all k. Gaussian estimation error 
can be justified as discussed in l43ll or by the use of a recursive 
ML estimator as in l44l . Unless otherwise stated, we take 
<7 = 0.5, i.e., the estimation error is rather significant relative 
to the mean cross-channel gain. Note that, in this section, we 
choose the margin Pj(k) such that 

pj(k) <max[log(l+P/z // )] 

We consider logarithmic private and open utility functions 
where the private utility is K times more than open utility at 
the same rate. More specifically, we take for a scheduled node 
j, Uf(k) = JC-log(l +R p (k)), and Uj(k) = log(l +R°j(k)). We 



{hji,i^j} < Yj 



take k = 5 in all the experiments except for the one inspecting 
the effect of K. The rates depicted in the graphs are per node 
arrival or service rates calculated as the total arrival or service 
rates achieved by the network divided by the number of nodes, 
i.e., the unit of the plotted rates is bits/channel use/node. 
Finally, for perfect CSI, we only plot the service rates since 
arrival and service rates are identical. 

In Fig. !7aH7bl we investigate the effect of system parameter 

V in our dynamic control algorithm. Fig. [7a] shows that for 

V > 4, long-term utilities converge to their optimal values 
fairly closely. It is also observed that CSI estimation error 
results in a reduction of approximately 25% in aggregate 
utility. Fig. [7b] depicts the well-known relationship between 

V and queue backlogs, where queue backlogs increase when 

V is increased. 

In Fig. [8all8bl the effect of increasing number of nodes 
on the achievable private and open rates obtained with the 
proposed dynamic control algorithm is shown. In both figures, 
the private information rate achieved by POS algorithm given 
in Section [III] is also depicted. From Fig. [8a] we first notice 
that by using the dynamic control algorithm which is based 
only on the instantaneous CSI, the private service rate is 
reduced by more than 25% as compared to the maximum 
private information rate achieved by POS which uses a priori 
CSI to encode over many blocks. This difference increases 
with increasing number of nodes. However, for both POS 
and dynamic control algorithms, the achievable rates decrease 
with increasing number of nodes since more nodes overhear 
ongoing transmissions. Meanwhile, open service rate also 
decreases due to the fact that there is a smaller number of 
transmission opportunities per node with increasing number of 
nodes. Fig. [8b] depicts that private service rate has decreased 
by approximately 50% due to CSI estimation errors. It is 
also interesting to note that private arrival rate is higher than 
the private service rate, since all private messages for which 
perfect privacy constraint cannot be satisfied are considered 
as successful open messages. Hence, open service rate is 
observed to be higher than the open arrival rate. 

We next analyze the effect of k, which can also be inter- 
preted as the ratio of utility of private and open transmissions 
taking place at the same rate. We call this ratio private utility 
gain. Fig. [9a] shows that when private utility gain is greater 
than 5, then the private and open service rates converge to 
their respective limits. These limits depend on the channel 
characteristics, and their sum is approximately equal to the 
maximum achievable rate of the channel. However, when 
there is CSI estimation error, Fig. [9b] shows that although 
an identical qualitative relationship between arrival rates and 
private utility gain is still observed, private service rate is lower 
than the private arrival rate by a fraction of y almost uniformly 
in the range of K. 

In Fig. UOal we investigate the effect of the tolerable 
privacy outage probability. It is interesting to note that private 
service rate increases initially with increasing tolerable outage 
probability. This is because for low y values, in order to 
satisfy the tight privacy outage constraint, a low instantaneous 
private information rate is chosen. However, when y is high 
more privacy outages are experienced at the expense of higher 
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Fig. 9. Private and open rates with respect to increasing amount of private utility gain. 
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(b) Imperfect CSI 



instantaneous private information rates. This is also the rea- 
son why we observe that the difference between the private 
service and arrival rates is increasing. We note that when CSI 
estimation error is present, the highest private service rate is 
obtained when y is approximately equal to 0.1. The highest 
private service rate with CSI estimation error is approximately 
30% lower than the private service rate with the perfect CSI. 

We finally investigate the effect of the quality of CSI 
estimator in Fig. II Obi For this purpose, we vary the standard 
deviation of the Gaussian random variable modeling the es- 
timation error. As expected the highest private service rate 
is obtained when a = 0. However, it is important to note 
that this value is still lower than the private service rate with 
perfect CSI, since privacy outages are still permitted in 10% 
of private transmissions. We have also investigated the perfor- 



mance of the dynamic control algorithm when a posteriori CSI 
distribution is not available. In this case, scheduling and flow 
control decisions are based only on the mean cross channel 
gains. When only mean cross channel gains are available, the 
achieved private service rate per node is approximately equal 
to 0.16 bits per channel use, which is significantly lower than 
the private service rate with perfect CSI. In particular, it is 
only when the standard deviation of the estimation error is 0.7 
that the private service rate with noisy channel estimator has 
the same private service rate achievable utilizing only mean 
channel gains. yj CoNCLUSIONS 

In this paper, we studied the achievable private and open 
information rate regions of single- and multi-user wireless net- 
works with node scheduling. We introduce private opportunis- 
tic scheduling along with a private encoding strategy, and show 
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Fig. 10. Private and open rates with respect to tolerable privacy outage probability. 



(b) Effect of o\ 



that it maximizes the sum private information rate for both 
multiuser uplink communication when perfect CSI is available 
for only the main uplink channels. Then, we described a cross- 
layer dynamic algorithm that works without prior distribution 
of channel states. We prove that our algorithm, which is based 
on simple index policies, achieves utility arbitrarily close to 
achievable optimal utility. The simulation results also verify 
the efficacy of the algorithm. 

As a future direction, we will investigate the cooperation 
among nodes, e.g., intelligent jamming from cooperating 
nodes, as a means to improve the achievable private informa- 
tion rates. We will also investigate an extension of the dynamic 
control policy for imperfect CSI, where the optimal privacy 
outage probability is also determined by the algorithm. 
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Appendix A 
Proof of TheoremQ] 

Let us further introduce the following notation: 
Wj and : randomization sequence associated with message W pnv , 
X(k): transmitted vector of (Ni) symbols over block k, 
Xj = {X(k)\j^f os (k) = 1}: the transmitted signal over block 
k, whenever ^0j os {k) = 1 (i.e., node j is the active transmitter) 
Yj(k): the received vector of symbols at node ; (Y&(&) for the 
base station) over block k, 

Yj = {Y 'i(k)\^j '(k) = 1}: the received signal at node i over 
block k, whenever yj° s (k) = 1 (i.e., node j is the active 
transmitter). We use Yj for the received signal by the base 
station. 

The equivocation analysis follows directly for the described 
privacy scheme: For any given node j, we have 



H(Wf™\Yf)>H(Wj™\Yt ') 



(36) 



>I{wf\W^Y[,...,Yi\Y{, {f) ) 
-H{Wf aA \Y j n . v Wf n ) 

> I(wf v ,Wf d ; ¥{,. . . ,Y{\Y j nj) ) -Nei (38) 

/(X/:Y; Y> Y J f . i 

-/(X,-;Y{,. . . ,Y2|Y£ ( jV wf,W)™ A ) -N £l 

(39) 

> 7(X /; Y{,...,Yl \Yj, {j) )-N(e 1 + e 2 ) (40) 

= /(X;; Y[ Y>) /(X;; Y> {j] ) - Nfa + £ 2 ) 

(41) 

> KXfYj) - /(Xj;Y£ w ) -N(e l + e 2 ) (42) 

£ [l(X(k);Yj(k))-I(X(ky,Y m (k))} 

k:Sf os (k) = l 

-N{e x + e 2 ) (43) 

> N [pf ((Rj -8)- *7) - (e, + e 2 + £ 3 )] 

(44) 

with probability 1, for any positive (£i,£2,£3) triplet and 
arbitrarily small <5, as N\,N 2 go to °o. Here, (l36l l follows since 
= argmax,. e{1> ... in} /(W? nv ;Y/) (W ; pnv o X ( o Y^., o 

Y^ forms a Markov chain for all i and data processing inequal- 
ity), d37b is by the chain rule, d38l follows from the application 
of Fano's inequality (as we choose the rate of the randomiza- 
tion sequence to be N(RJ - 8) < /(WJ^YL A which allows 
for the randomization message to be decoded at node 
given the bin index), ( |39l follows from the chain rule and that 
{Wf { \W] znA ) O Xj <-> (Y{,...,Y J „) forms a Markov chain, 

© holds since /(X;;Y{, . . . , Y J „\YL jV W? riv ,WJ and ) <A^£ 2 as 
the transmitted symbol sequence Xj is determined w.p. 1 given 
(Y^ (; . ) ,W J priv ,W r 7 rand ), 61} follows from the chain rule, 63 

holds since Y ] ,{k) is an entry of vector \Y\ (k),.. . , Y } n (k)\, ( l43b 
holds because the fading processes are iid, and finally ( l44l ) 
follows from strong law of large numbers. 

Thus, with the described privacy scheme, the perfect privacy 
constraint is satisfied for all nodes, since for any j G { 1 , . . . , «}, 
we have 

i/(Wf v ;Y/) = ±(H(wf v ) -H(wf\Y{)) 



N 

< Rf - [Pf ((Rf 5) - R'J) (£, + £ 2 + £ 3 ) 
<£, 



(45) 



= I(Wj m ;Y\,...,Yi\Yi, (j) )+H(wf v \Yi 1 ...,Yi 
>/(wf v ;Y{,...,Y^|Y^ ( . ) ) 



: I(Wj n \W™ nd ;Y J v 

_ /(w rand 



1 1 ■ 



I(W) 



pnv 



w 



,Y{ 

rand . \rj 



■•.YjtlY^) 



(37) 



-H{Wf aA \Y ] n . y W ] 
■H(W] 



pnv-. 



rand | -%tJ 

Mi" 



for any given £ > 0. We just showed that, with private 
Opportunistic scheduling, a private information rate of Rp" v = 
Pj(Rj—R"f) is achievable for any given node j. ■ 

Appendix B 
Proof of Theorem[2] 

The proof uses the notation introduced in the first 
paragraph of Appendix [A] To meet the perfect secrecy 
constraint, it is necessary and sufficient to guarantee 
lirriA,^ Wf w ; Y£ (j) ) < £ for all nodes j G {1 , . . . , n}. Since 
n < oo, one can write an equivalent condition on the sum 
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mutual information over each node: 



e'>lil(wr,Yi (j) ) 



^z-^imr\ Y U 

V 7=1 

-£\i(wf v M,...,Yi\Yi U) ) 



(46) 



npnv 
sum 



N 



7=1 



+//(Wf v |Yj,...,Y/ 7 ) 



1 A 



7=1 



/(W; and ; Yj, . . .,Y{\Y ] W] m ) + Ne 4 



(47) 



with probability 1, for any positive e' and (£4, £5, £6) triplet 
as N\,N2 go to 00. Here, d46b follows from the definition 
of /Cm and that jjH(wf n ) = Rf v ; (|47j follows from the 
chain rule and Fano's inequality (as H(Wj \Y J v ...,Y J n ) < 
//(W / priv ,Wj' and |Y{,...,Y/i) < Ns 4 since the message pair 
(W? nv , W™ nd ) can be decoded with arbitrarily low proba- 
bility of error given (Yj, . . . , Y/,)); (|48| i is from the data 
processing inequality as (Wf"\ W and ) o X y o (Y{,. . . ,Y/,) 
forms a Markov chain; (|49b and (150b follow from the chain 
rule; (IBTl l follows from the data processing inequality; (l52l 
follows since node / decodes message W? nv with arbitrarily 
low probability of error £5; ( l53l holds since the fading pro- 
cesses are iid; ( |54l holds because private opportunistic sched- 
uler chooses .yJ os (k) = argmaxy.^ [Rj(k) — Rji*^(k)] = 

argmax^ [/(X(fc);Yi(*)) -/(X(*)';Yj. W (*))] for all k; and 
finally d531 ) follows by an application of the strong law of large 
numbers. The above derivation leads to the desired result: 



> <m - -j E [/(Wf v , Wf nd ; Y{, . . . , Y/JY> (;) ) + JV£ 4 



7=1 



(7)' 



^<E[^(^f-^)] 

7=1 



(56) 



1 A 



7=1 



> c - -j E 7 ( x /; Y i. • • • > Y »l Y ™) + N£ + 



(48) 



C - -j E [ 7 ( X ^ Y i' • • • > Y ^) -t&fi Y i ( ;)) + N£ * 



7=1 



-I(X r ,YJ)+Ne 4 



(49) 



(50) 



We complete the proof noting that the above sum rate is 
achievable by private opportunistic scheduling as shown in 
(Eg). ■ 
Note that, from the above steps, we can also see that 
the individual private information rates given in Theorem Q] 
are the maximum achievable individual rates with private 
opportunistic scheduling. This is due to the fact that, for 
any node j, with private opportunistic scheduling, the above 
derivation lead to: 



1 A 



7=1 



> <m - jj E 7 ( x y; y j) + h ( x j\ y j) '(Xy;v/. ,) +ne 4 



H(Wj 



1V| Y J 



)<PJ 



-R'l 



(57) 



1 A 



7=1 



> C - Jf E 7 ( X ;' Y j) +^(Wf V |Yj) -7(X ; ;Y^ (y) ) + JV£ 4 



(51) 



— "sum 



N 



£ Z(X /: Y}) -/(Xy;Y/ n )+/V( £4 + £5 ) 



7=1 



(52) 



^-^E E [W);Y fc (*)) 

7=1 [kJ?j{k)=\ 

-I(X(k);Y iHj) (k))]+e 4 + e 5 } (53) 



1 A 



>^m-TrE max ^ £ [/(X(*);Y 6 (*)) 
^y=i>y(*) lfc^)=i 



for any £ > as iV — ► Consequently, with private oppor- 
tunistic scheduling, no node can achieve any individual privacy 
rate above that given in (|57| |. hence the converse of TheoremQ] 
also holds. 

Appendix C 
Proof of Lemma[T] 

Proof: Since the maximum transmission power is fi- 
nite, in any interference-limited system transmission rates are 
bounded. Let R p ' and R ,' be the maximum private and 
open rates for user j, which depends on the channel states. 
Also assume that the arrival rates are bounded, i.e., A p -' max 
and A?' be the maximum number of private and open bits 
that may arrive in a block for each user. Hence, the following 
inequalities can be obtained for each private queue: 



-I(X(k);Y Hj) (k))]+e 4 + e 5 } 



1 " 



^um-^Ei E [/(X(*);Y,(*)) 



7=1 {t.yP 0S (k)=i 

I(X(k);Y nj) (k))]+£ 4 + e 5 } (54) 



(g?(*+i)) 2 -(g?(*)) 2 

= (\ i Q p J {k)-R p j {k) 

<(g;«) 2 +(a;«) 



-(R P (k)) 2 



{Q){k)Y 



> Cm E iff ( R f R 7) + £ 4 + £5 + Cfe] 
7=1 



(55) 



-IQ^yR^-A^-iQ^k)) 2 
< (R P (k)) 2 + (A p (k)) 2 -2Q?(k)[R P (k) -A p (k)} 
<2?i-2j2j(jfc)[Rj(jfc)-Aj(jfc)] (58) 
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where B\ = (Ry ) + (Ay" '' ) . The same line of derivation 
can be performed for open queues to obtain: 

(Q»(k+l)) 2 -(Q«(k)) 2 

= ([Q%k)-R%k)] + +A°j(k)) 2 -(Q°-(k)) 2 
<B 2 -2Q° j {k)[R° j {k)-A° j {k)} (59) 

where B 2 = (R"." mx ) 2 + (Ay™*) 2 . 

Hence, by taking expectation, multiplying by i, and sum- 
ming (I58l>-(l59l> over all j = 1 we obtain the upper bound 
on A(k) as given in the Lemma, where B = n(B\ + B2) /2. ■ 

Appendix D 
Proof of TheoremO 

Proof: Lyapunov Optimization Theorem If37l suggests 
that a good control strategy is the one that minimizes the 
following: 



Q p (k),Q°(k) 



A u (k) = A(k) —VE 



(60) 

By using d24l i. we may obtain an upper bound for (I6OI 1. as 
follows: 

A u {k)<B-Y^[Q)mR P j m-A p j {k)] I Q p j{k) 

i 

-^Qm R "j( k )- A! m\Q°A k )} 



-VI 



£tf/(A?(fc))+£f/;w) 



(61) 



By rearranging the terms in (|6TT > it is easy to observe that 
our proposed dynamic network control algorithm minimizes 
the right hand side of (l6Tb . 

If the private and open arrival rates are in the feasible region, 
it has been shown in B31 that there must exist a stationary 
scheduling and rate control policy that chooses the users and 
their transmission rates independent of queue backlogs and 
only with respect to the channel statistics. In particular, the 
optimal stationary policy can be found as the solution of a 
deterministic policy if a priori channel statistics are known. 

Let U* be the optimal value of the objective function of the 
problem <n~5b-(fT6b obtained by the aforementioned stationary 
policy. Also let Xj and X°* be optimal private and open 
traffic arrival rates found as the solution of the same problem. 
In particular, the optimal input rates Aj and X"* could 
in principle be achieved by the simple backlog-independent 
admission control algorithm of including all new arrivals 
(A P j(k),A°(k)) for a given node j in block k independently 
with probability (£/,£?) = {Xf*/Xf, Xf/Xf). Then, the right 
hand side (RHS) of d6lT l can be rewritten as 



j 

- £E [Q°.(k)} E [R°.(k) -A°j(k)] -VU*. 



(62) 



j 

Also, since (Xj ,XJ *) G A, i.e., arrival rates are strictly interior 
of the rate region, there must exist a stationary scheduling and 



rate allocation policy that is independent of queue backlogs 
and satisfies the following: 



E 



Q p 



>Xf 



■£1 



E [R) I Q°] > Xf + e 2 



(63) 
(64) 




Clearly, any stationary policy should satisfy ( f6Tb - Recall 
that our proposed policy minimizes RHS of d6Tb , and hence, 
any other stationary policy (including the optimal policy) has 
a higher RHS value than the one attained by our policy. In 
particular, the stationary policy that satisfies (I63b-d64l>, and 
implements aforementioned probabilistic admission control 
can be used to obtain an upper bound for the RHS of our 
proposed policy. Inserting (f63T>-(f64b into d62l , we obtain the 
following upper bound for our policy: 

RHS <B-^e 1 E[Q p j (k)]-^e 2 E[Q° j (k)]-VU*. (65) 

j j 

This is exactly in the form of Lyapunov Optimization Theorem 
given in Theorem [3] and hence, we can obtain bounds on the 
performance of the proposed policy and the sizes of queue 
backlogs as given in Theorem H] ■ 
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